DongTai IAST

Input—per 1M tokens

Output—per 1M tokens

Context—tokens

WeightsClosed

About

DongTai IAST is ranked #3 of 14 in interactive application security testing software on Inferse. It runs on API, Linux, Self-hosted, Web.

Compared on interactive application security testing software

Runtime targets: webiast.io
Deployment: hybridiast.io
API testing: Yesiast.io
Instrumentation: agentiast.io
Language coverage: Java, Python, PHP, Goiast.io

Facts

Product: DongTai IAST is an open-source interactive application security testing tool that uses passive instrumentation to detect common vulnerabilities in Java applications and third-party components in real time.github.com · 3 Oct 2026
Analysis: The project describes its engine as analyzing HTTP, HTTPS, and RPC requests using method-call data and taint tracking.github.com · 3 Oct 2026
Detection languages: The documentation lists Java, Python, PHP, and Go as supported detection languages.docs.dongtai.io · 3 Oct 2026
Vulnerability workflow: The overview says DongTai analyzes runtime application data flows, prioritizes verified vulnerabilities by risk, and helps developers fix code in real time.docs.dongtai.io · 3 Oct 2026
Deployment: The project supports SaaS and localized deployment, with Docker Compose for standalone installation and Kubernetes for cluster deployment.github.com · 3 Oct 2026
Server capabilities: The server provides a user management interface, vulnerability analysis and reports, vulnerability notifications, Web API, project management, and custom vulnerability rules.docs.dongtai.io · 3 Oct 2026
IDE integration: The project describes an IntelliJ IDEA plugin that can run the Java probe and detect vulnerabilities inside the IDE.github.com · 3 Oct 2026
Use cases: The project lists DevSecOps vulnerability detection, open-source vulnerability research, and security testing before release as use cases.github.com · 3 Oct 2026
IAST method: The documentation identifies DongTai as passive IAST, using application test traffic to analyze vulnerabilities without running dedicated attack tests.docs.dongtai.io · 3 Oct 2026
Agent status: The agent guide marks Python, PHP, and Go agents as beta and says community-maintained beta agents are not guaranteed to deploy successfully.docs.dongtai.io · 3 Oct 2026
Runtime services: The project says its base image includes MySQL and Redis services.github.com · 3 Oct 2026
License: The repository lists an Apache-2.0 license.github.com · 3 Oct 2026
Support: The project directs users with questions to its GitHub Discussions forum.github.com · 3 Oct 2026